SEC registrants are required to make a disclosure within 4 business days once a cybersecurity incident is deemed by the company to be material to a reasonable investor.
https://www.sec.gov/news/statement/gerding-cybersecurity-dis...
https://www.sec.gov/news/statement/gerding-cybersecurity-dis...
All my previous comments on this specific story have been that this isn’t verified.
Lots of major news sites pulled the trigger on the headline for nothing more than clicks.
Some journalists say that Australian Home Affairs confirmed the breach… lol! They acknowledged the rumour, but that got spun as “verification”.
Then again, maybe it’s lack of decent cybersecurity writers.
I personally can’t stand this weaksauce writing with no fact checking and the nonchalant way of throwing companies under the bus.
[1] https://www.linkedin.com/posts/aucyberseccoord_today-i-was-a...
Whether or not it’s a rumour based on speculation has nothing to do with it. It either is or it isn’t.
There is no confirmation that it isn’t.
--
Just to provide receipts:
Home Affairs Department confirms cyber incident impacting Ticketmaster customers (https://www.abc.net.au/news/2024-05-29/ticketmaster-hack-all...) - May 29th
> The Department of Home Affairs said it is aware of a cyber incident impacting Ticketmaster customers in response to claims it is part of a data leak expected to impact millions of customers globally.
How exactly "being aware" counts as "confirmation" in this case?
Any other article (outside of those who used ABC Aus as a source) on this matter have specifically used words like "allegedly", "purported", etc.
That's the only argument I am making.
It clearly says:
A spokesperson from the Department of Home Affairs told the ABC it is "Working with Ticketmaster to understand the incident".
Which is more than they are aware of a rumour
Tickettek is Australia's largest ticketing company and a competitor to Ticketmaster
Are you saying data was stolen? Because the headline here is "allegedly." So, unless you know absolutely one way or the other, allegedly is accurate.
Irish Independent -> Hackers access half a billion customers’ data in Ticketmaster cyber attack
Gizmodo -> Ticketmaster Hack Reveals Sensitive Data for 560 Million People
Daily Mail -> Details of 560 million Ticketmaster customers are stolen in data leak
And so on...
(all these stories/headlines were published on May 29th, on the day when the rumor began to spread)
As long as the investor is hurt, right? The users are just collateral.
Also. As the excellent Matt Levine never ceases to repeat : everything is securities fraud.
If you didn't state in your regular filings "our security is poor, we may get hacked", then you lied by omission.
SEC 8K being enforced has been nothing but good overall.
These companies were being hacked and it was hidden from you.
Now, it’s open, embarrassing, and costly. So they’re taking security more seriously.
If you are concerned about share price, buy the dip on hack.
(E.g. “money laundering” seemed like a reasonable hack for the first couple of decades, but these days banks have turned into an surveillance and enforcement apparatus with a presumption of guilt and no right of appeal.)
If the expectation was that users were screwed and would not be entitled to any compensation, then the news of this breach would be no more material to the company’s investors than learning the at the air conditioning was set to the wrong temperature in one of the company’s offices for a few hours.